dsh-auto-review 0.13.4 → 0.13.6

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.13.6] - 2026-10-19
+
+### Fixed
+
+- **`/auto-review status` no longer calls the audit-disabled in-memory tally “All-time” (issue #50).** On a host where session-log audit is fail-closed, the numbers come from the per-turn memory mirror; the line is now labeled “This turn (audit disabled; in-memory)” / “本轮（审计已停用，内存统计）”, so a 0 after a turn with real verdicts is not presented as a lifetime total.
+
 ## [0.13.4] - 2026-10-18
 
 ### Changed
@@ -46,6 +52,18 @@
 
 All notable changes to `dsh-auto-review` are documented here. The repo is pre-release; versions follow the DeepSeek Harness `0.1.0-rc.x` target runtime and bump on every behavior change.
 
+## [0.13.5] - 2026-10-18
+
+### Fixed
+
+- **A secret spelled inside a free-form string argument reached the reviewer verbatim.** `sanitizeArguments` redacts by object KEY, so it sees `{"apiKey": "..."}` but not `deploy --token sk-live-123` or `curl -H "Authorization: Bearer …"` — which is how a secret usually appears in a shell call. Both rendering paths are covered now: the pending call's own preview (`sanitizeArguments`) and the compact transcript line (`contextLine`), the second being the one that reached the reviewer intact. Known limit, pinned by a test: a bare secret with no key adjacent to it (`echo sk-live-123`) stays visible — this is a heuristic, not a secret scanner.
+- **Truncated evidence read as complete evidence.** The pending call's preview is cut at `reasonMaxChars` (default 2000) behind a bare `…`, so a reviewer shown only the benign head of a long call could allow it with the decisive arguments cut off. A truncated preview is now labelled `TRUNCATED`, states the exact counts (`only the first <n> of <m> characters are shown; the remainder is NOT visible to you`), and the verdict rules gained the matching `- truncated evidence counts as insufficient: when the arguments are marked TRUNCATED, DENY.`
+- **The review panel showed all zeros on every host that declines the audit events.** The `autoReview` projection folds the plugin's own `autoReview/*` session events, and on a host whose `Session.append` cannot stamp the `ignorable` marker none of them is ever written — which is every published line — so the panel folded an empty log while the in-memory mirror held the real numbers. The persisted state now carries the owning `sessionId` (state version 4) and the runtime registers a live wire view that serves the switch state and the session's activity from the mirror; on a marker-aware host the pure fold stays authoritative and is returned untouched.
+
+### Added
+
+- `test/hardening.spec.ts` — a regression case per fix above, including the documented bare-secret limit. `test/projection.spec.ts` covers the state-version-4 contract and the substituted panel view.
+
 ## [0.12.17] - 2026-10-10
 
 ### Fixed

package/README-es.md

@@ -360,7 +360,7 @@ El servidor es de solo lectura y determinista: sin red, sin modelo, sin escritur
 - **Cierre en fallo.** Cada camino anómalo (proveedor ausente, carencias de capacidad, rechazo al iniciar, timeout, razón de parada no `completed`, veredicto ausente/malformado, fallo de correlación de auditoría) se resuelve con `fallbackPolicy`, por defecto `rejected` — y el rechazo devuelve una razón auditable al modelo. `allow-once` concede incondicionalmente; existe solo para despliegues desatendidos cuyo administrador acepta ese riesgo.
 - **Revisor de solo lectura.** La lista blanca `toolFilter` del revisor (`read`/`glob`/`grep`) no puede escribir, editar, ejecutar bash, acceder a la red ni delegar (`maxDepth` = su propia profundidad). Su registro de sesión se persiste y es auditable.
 - **Revisor aislado del contexto.** Los pasos del hijo revisor se filtran en la costura oficial `agent/pre-step`: solo entran su propio prompt y los resultados de sus propias herramientas de solo lectura. Los archivos de instrucciones del espacio de trabajo (`AGENTS.md` / `CLAUDE.md`) y los plugins que inyectan contexto se descartan en esa costura; **la instantánea de contexto de ejecución del propio harness se re-admite después de `agent/pre-step`, el firewall no la elimina y el revisor la ve.** Esto vale con CUALQUIERA de los proveedores de subagente — esos productores inyectan de nuevo en cada sesión de agente, así que lo que los cierra es el filtro y no la elección de proveedor. La lista blanca es por ORIGEN del mensaje, así que un plugin que declare un origen nuevo también se descarta.
-- **Los argumentos sensibles se redactan** (coincidencia por nombre de clave: `token`, `password`, `api_key`, `Authorization`, credenciales, claves privadas …) antes de entrar en el prompt del revisor; el plugin nunca ejecuta los argumentos revisados. La redacción se basa en claves, no en contenido — no revises con IA herramientas cuyos valores de argumento no te puedas permitir mostrar a un modelo.
+- **Los argumentos sensibles se redactan** (coincidencia por nombre de clave: `token`, `password`, `api_key`, `Authorization`, credenciales, claves privadas …) antes de entrar en el prompt del revisor, y un argumento de texto libre pasa además por una heurística en línea que enmascara las formas `KEY=VALUE` / `KEY: VALUE` / `--flag VALUE` y los esquemas `Bearer`/`Basic` — que es como suele aparecer un secreto en una llamada de shell. El plugin nunca ejecuta los argumentos revisados. Ambas pasadas son de mejor esfuerzo, no un escáner de secretos: un secreto sin clave al lado sigue siendo visible, así que no revises con IA herramientas cuyos valores de argumento no te puedas permitir mostrar a un modelo.
 - **Las desactivaciones duras se explican a sí mismas.** Una herramienta o regla de riesgo `never` rechaza de forma determinista Y registra un evento solo-registro `autoReview/rejection`, y luego inyecta un marcador `[auto-review-never]` en el resultado de la herramienta denegada — el modelo aprende que la acción está duramente desactivada en lugar de reintentarla (verificado por invariant: marcador ⟺ evento).
 - **Disyuntor de rechazos.** Una racha de denegaciones en un turno dispara el disyuntor (`consecutiveDenies` / `windowDenies` dentro de `windowSize`), registrada como un evento solo-registro `autoReview/circuit`; las solicitudes posteriores siguen su `action` (`delegate` / `reject` / `abort-turn`).
 - **El contexto del revisor es transcripción ya presentada.** `contextBudget` alimenta al revisor con contenido de sesión ya presentado. Con el modelo revisor de la misma ruta por defecto, ese contenido permanece dentro de un proveedor; configura `reviewerModel` a un proveedor diferente solo si aceptas presentarle esa transcripción.

package/README-hi.md

@@ -392,7 +392,9 @@ dsh-eval eval/cases --model deepseek-flash --timeout-ms 240000 --out .eval-repor
 
 </details>
 
-</details>## MCP सर्वर (स्टैंडअलोन)
+</details>
+
+## MCP सर्वर (स्टैंडअलोन)
 
 `dsh-auto-review` एक stdio **MCP सर्वर** (`dsh-auto-review-mcp`) भी देता है ताकि बाहरी MCP क्लाइंट (Claude, Codex, …) बिना harness के एक निर्धारक समीक्षा पथ का उपयोग कर सकें। यह newline-delimited JSON (NDJSON) पर JSON-RPC 2.0 बोलता है — प्रति पंक्ति एक JSON ऑब्जेक्ट, कोई `Content-Length` फ़्रेमिंग नहीं।
 
@@ -447,7 +449,7 @@ Claude Desktop (`claude_desktop_config.json`) उदाहरण:
 - **विफल-बंद।** हर असामान्य मार्ग (प्रदाता अनुपस्थित, क्षमता अंतराल, प्रारंभ अस्वीकृति, टाइमआउट, गैर-`completed` स्टॉप कारण, अनुपस्थित/विकृत निर्णय, ऑडिट-सहसंबंध विफलता) `fallbackPolicy` से हल होता है, डिफ़ॉल्ट `rejected` — और अस्वीकृति मॉडल को एक ऑडिट-योग्य कारण लौटाती है। `allow-once` बिना शर्त अनुमति देता है; यह केवल उन अप्रबंधित परिनियोजनों के लिए है जिनका व्यवस्थापक उस जोखिम को स्वीकार करता है।
 - **केवल-पढ़ने वाला समीक्षक।** समीक्षक की `toolFilter` अनुमति-सूची (`read`/`glob`/`grep`) लिख, संपादित, bash चला, नेटवर्क उपयोग या प्रत्यायोजन नहीं कर सकती (`maxDepth` = उसकी अपनी गहराई)। उसका सत्र लॉग स्थायी और ऑडिट-योग्य है।
 - **संदर्भ-पृथक समीक्षक।** समीक्षक चाइल्ड के हर चरण को आधिकारिक `agent/pre-step` सीम पर छाना जाता है: केवल उसका अपना प्रॉम्प्ट और उसके अपने केवल-पढ़ने वाले टूल परिणाम ही भीतर आते हैं। वर्कस्पेस निर्देश फ़ाइलें (`AGENTS.md` / `CLAUDE.md`), हार्नेस का रनटाइम-संदर्भ स्नैपशॉट और संदर्भ इंजेक्ट करने वाला कोई भी प्लगइन लूप द्वारा जोड़े जाने से पहले हटा दिए जाते हैं, इसलिए रिपॉज़िटरी-नियंत्रित पाठ कभी उस घटक तक नहीं पहुँचता जो कॉल की अनुमति तय करता है। यह किसी भी subagent प्रदाता के साथ लागू होता है — ये उत्पादक हर नए एजेंट सत्र में नए सिरे से इंजेक्ट करते हैं, इसलिए इन्हें बंद करने वाला यही फ़िल्टर है, प्रदाता का चुनाव नहीं। अनुमति-सूची संदेश के स्रोत पर आधारित है, इसलिए नया स्रोत घोषित करने वाला प्लगइन भी हटा दिया जाता है।
-- **संवेदनशील तर्क संशोधित किए जाते हैं** (कुंजी-नाम मिलान: `token`, `password`, `api_key`, `Authorization`, क्रेडेंशियल, निजी कुंजियाँ …) समीक्षक प्रॉम्प्ट में जाने से पहले; प्लगइन समीक्षित तर्कों को कभी निष्पादित नहीं करता। संशोधन कुंजी-आधारित है, सामग्री-आधारित नहीं — उन टूल की AI समीक्षा न करें जिनके तर्क मान आप किसी मॉडल को दिखाने का जोखिम नहीं उठा सकते।
+- **संवेदनशील तर्क संशोधित किए जाते हैं** (कुंजी-नाम मिलान: `token`, `password`, `api_key`, `Authorization`, क्रेडेंशियल, निजी कुंजियाँ …) समीक्षक प्रॉम्प्ट में जाने से पहले, और एक मुक्त-रूप स्ट्रिंग तर्क पर अतिरिक्त रूप से एक इनलाइन अनुमान लगता है जो `KEY=VALUE` / `KEY: VALUE` / `--flag VALUE` रूपों तथा `Bearer`/`Basic` स्कीमों को छिपा देता है — शेल कॉल में सीक्रेट प्रायः इसी तरह दिखता है। प्लगइन समीक्षित तर्कों को कभी निष्पादित नहीं करता। दोनों पास सर्वोत्तम-प्रयास हैं, कोई सीक्रेट स्कैनर नहीं: बिना कुंजी वाला नंगा सीक्रेट दिखता रहता है, इसलिए उन टूल की AI समीक्षा न करें जिनके तर्क मान आप किसी मॉडल को दिखाने का जोखिम नहीं उठा सकते।
 - **कठोर अक्षमताएँ स्वयं को समझाती हैं।** एक `never` टूल या जोखिम नियम निर्धारक रूप से अस्वीकार करता है और एक केवल-लॉग `autoReview/rejection` घटना दर्ज करता है, फिर अस्वीकृत टूल परिणाम में एक `[auto-review-never]` मार्कर इंजेक्ट करता है — मॉडल सीखता है कि क्रिया कठोर रूप से अक्षम है बजाय उसे पुनः प्रयास करने के (invariant-जाँचा गया: मार्कर ⟺ घटना)।
 - **अस्वीकृति सर्किट ब्रेकर।** एक टर्न में अस्वीकृतियों की एक शृंखला ब्रेकर को ट्रिप करती है (`windowSize` के भीतर `consecutiveDenies` / `windowDenies`), जो एक केवल-लॉग `autoReview/circuit` घटना के रूप में दर्ज होती है; बाद के अनुरोध उसकी `action` (`delegate` / `reject` / `abort-turn`) का पालन करते हैं।
 - **समीक्षक संदर्भ प्रस्तुत ट्रांसक्रिप्ट है।** `contextBudget` समीक्षक को पहले से प्रस्तुत सत्र सामग्री खिलाता है। डिफ़ॉल्ट समान-मार्ग समीक्षक मॉडल के साथ वह सामग्री एक ही प्रदाता के भीतर रहती है; `reviewerModel` को किसी भिन्न प्रदाता पर तभी कॉन्फ़िगर करें जब आप उस ट्रांसक्रिप्ट को उसे प्रस्तुत करना स्वीकार करते हों।

package/README-pt.md

@@ -360,7 +360,7 @@ O servidor é somente-leitura e determinista: sem rede, sem modelo, sem gravaç
 - **Falha fechada.** Todo caminho anômalo (provedor ausente, lacunas de capacidade, rejeição ao iniciar, timeout, razão de parada não `completed`, veredito ausente/malformado, falha de correlação de auditoria) se resolve via `fallbackPolicy`, padrão `rejected` — e a rejeição devolve uma razão auditável ao modelo. `allow-once` concede incondicionalmente; existe apenas para implantações desatendidas cujo administrador aceita esse risco.
 - **Revisor somente leitura.** A lista de permissões `toolFilter` do revisor (`read`/`glob`/`grep`) não pode escrever, editar, executar bash, acessar a rede nem delegar (`maxDepth` = sua própria profundidade). Seu log de sessão é persistido e auditável.
 - **Revisor isolado do contexto.** Os passos do filho revisor são filtrados na costura oficial `agent/pre-step`: apenas o seu próprio prompt e os resultados das suas próprias ferramentas somente leitura entram. Arquivos de instruções do workspace (`AGENTS.md` / `CLAUDE.md`) e plugins que injetam contexto são descartados nessa costura; **o instantâneo de contexto de execução do próprio harness é readmitido após `agent/pre-step`, o firewall não o remove e o revisor o vê.** Isso vale sob QUALQUER provedor de subagente — esses produtores injetam de novo em cada sessão de agente, então o que os fecha é o filtro, não a escolha do provedor. A lista de permissões é por ORIGEM da mensagem, então um plugin que declare uma origem nova também é descartado.
-- **Argumentos sensíveis são redigidos** (correspondência por nome de chave: `token`, `password`, `api_key`, `Authorization`, credenciais, chaves privadas …) antes de entrar no prompt do revisor; o plugin nunca executa os argumentos revisados. A redação é baseada em chave, não em conteúdo — não revise com IA ferramentas cujos valores de argumento você não pode se dar ao luxo de mostrar a um modelo.
+- **Argumentos sensíveis são redigidos** (correspondência por nome de chave: `token`, `password`, `api_key`, `Authorization`, credenciais, chaves privadas …) antes de entrar no prompt do revisor, e um argumento de texto livre passa ainda por uma heurística em linha que mascara as formas `KEY=VALUE` / `KEY: VALUE` / `--flag VALUE` e os esquemas `Bearer`/`Basic` — que é como um segredo costuma aparecer numa chamada de shell. O plugin nunca executa os argumentos revisados. Ambas as passadas são de melhor esforço, não um scanner de segredos: um segredo sem chave ao lado continua visível, então não revise com IA ferramentas cujos valores de argumento você não pode se dar ao luxo de mostrar a um modelo.
 - **Desativações duras se explicam.** Uma ferramenta ou regra de risco `never` rejeita de forma determinística E registra um evento somente-log `autoReview/rejection`, e então injeta um marcador `[auto-review-never]` no resultado da ferramenta negada — o modelo aprende que a ação está duramente desativada em vez de tentar novamente (verificado por invariant: marcador ⟺ evento).
 - **Disjuntor de rejeições.** Uma sequência de negações em um turno dispara o disjuntor (`consecutiveDenies` / `windowDenies` dentro de `windowSize`), registrada como um evento somente-log `autoReview/circuit`; solicitações posteriores seguem sua `action` (`delegate` / `reject` / `abort-turn`).
 - **O contexto do revisor é transcrição apresentada.** `contextBudget` alimenta o revisor com conteúdo de sessão já apresentado. Com o modelo revisor da mesma rota por padrão, esse conteúdo permanece dentro de um provedor; configure `reviewerModel` para um provedor diferente apenas se você aceitar apresentar essa transcrição a ele.

package/README-zh.md

@@ -360,7 +360,7 @@ Claude Desktop（`claude_desktop_config.json`）配置示例：
 - **失败关闭。** 每条异常路径（provider 缺失、能力缺口、启动拒绝、超时、非 `completed` 停止原因、缺失/畸形裁决、审计关联失败）都经由 `fallbackPolicy` 处理，默认 `rejected` —— 且拒绝会向模型反馈一条可审计的理由。`allow-once` 是无条件放行；它只用于接受该风险的无值守部署。
 - **只读审查器。** 审查器的 `toolFilter` 白名单（`read`/`glob`/`grep`）无法写入、编辑、运行 bash、访问网络或委派（`maxDepth` = 自身深度）。其会话日志被持久化且可审计。
 - **上下文隔离的审查器。** 审查器子代理的每一步都在官方 `agent/pre-step` 接缝上被过滤：只有它自己的提示词与它自己的只读工具结果能够进入。工作区指令文件（`AGENTS.md` / `CLAUDE.md`）与注入上下文的插件会在该接缝处被丢弃；**宿主自己的运行时上下文快照会在 `agent/pre-step` 之后被循环重新接纳，防火墙无法移除它，因此审查器能看到该快照。**这在任一 subagent provider 下都成立——这些注入方会向任何新建的 agent 会话重新注入，因此关闭它们的是这道过滤，而不是 provider 的选择。白名单按消息来源判定，所以声明了新来源类型的插件同样会被丢弃。
-- **敏感参数会被脱敏**（按键名匹配：`token`、`password`、`api_key`、`Authorization`、凭据、私钥……）后才进入审查器提示词；该插件绝不会执行被审查的参数。脱敏是按键名而非内容 —— 不要把参数值经不起展示给模型的工具交给 AI 审查。
+- **敏感参数会被脱敏**（按键名匹配：`token`、`password`、`api_key`、`Authorization`、凭据、私钥……）后才进入审查器提示词；自由字符串参数还会额外经过一层内联启发式，掩掉 `KEY=VALUE` / `KEY: VALUE` / `--flag VALUE` 这几种写法以及 `Bearer`/`Basic` 方案 —— 而命令行里的密钥通常正是这样出现的。该插件绝不会执行被审查的参数。两层都是尽力而为，不是密钥扫描器：旁边没有键名的裸密钥仍然可见，所以不要把参数值经不起展示给模型的工具交给 AI 审查。
 - **硬禁用会自我解释。** `never` 工具或风险规则确定性拒绝，并记录一条仅日志的 `autoReview/rejection` 事件，然后把 `[auto-review-never]` 标记注入被拒绝的工具结果 —— 模型学会该操作已被硬禁用，而不是重试（invariant 校验：标记 ⟺ 事件）。
 - **拒绝熔断器。** 一轮内连续拒绝会触发熔断（`consecutiveDenies` / 窗口内的 `windowDenies`），记录为仅日志的 `autoReview/circuit` 事件；后续请求按其 `action`（`delegate` / `reject` / `abort-turn`）处理。
 - **审查上下文是已呈现的 transcript。** `contextBudget` 把已呈现的会话内容喂给审查器。默认同路由审查模型时该内容停留在单一 provider 内；仅当你接受把该 transcript 呈现给另一 provider 时，才把 `reviewerModel` 配成别的 provider。

package/README.md

@@ -363,7 +363,7 @@ The server is read-only and deterministic: no network, no model, no writes.
 - **Fail closed.** Every abnormal path (provider missing, capability gaps, start rejection, timeout, non-`completed` stop reason, missing/malformed verdict, audit-correlation failure) resolves through `fallbackPolicy`, default `rejected` — and the rejection feeds an auditable reason back to the model. `allow-once` grants unconditionally; it exists only for unattended deployments whose admin accepts that risk.
 - **Read-only reviewer.** The reviewer's `toolFilter` allow-list (`read`/`glob`/`grep`) cannot write, edit, run bash, fetch the network, or delegate (`maxDepth` = its own depth). Its session log is persisted and auditable.
 - **Context-isolated reviewer.** The reviewer child's steps are filtered on the documented `agent/pre-step` seam: only its own prompt and its own read-only tool results enter them. Workspace instruction files (`AGENTS.md` / `CLAUDE.md`) and context-injecting plugins are dropped from the step this seam controls. **The host's own runtime-context snapshot is re-admitted by the loop after `agent/pre-step`; the firewall does not remove it, so the reviewer sees it.** This holds under EITHER subagent provider. The filter is an allow-list over message SOURCES, so a plugin that declares a new source kind is dropped too.
-- **Sensitive arguments are redacted** (key-name matching: `token`, `password`, `api_key`, `Authorization`, credentials, private keys …) before entering the reviewer prompt; the plugin never executes the reviewed arguments. Redaction is key-based, not content-based — do not AI-review tools whose argument values you cannot afford to show a model.
+- **Sensitive arguments are redacted** (key-name matching: `token`, `password`, `api_key`, `Authorization`, credentials, private keys …) before entering the reviewer prompt, and a free-form string argument additionally passes an inline heuristic that masks the `KEY=VALUE` / `KEY: VALUE` / `--flag VALUE` spellings and `Bearer`/`Basic` schemes — which is how a secret usually appears in a shell call. The plugin never executes the reviewed arguments. Both passes are best-effort, not a secret scanner: a bare secret with no key next to it stays visible, so do not AI-review tools whose argument values you cannot afford to show a model.
 - **Hard disables explain themselves.** A `never` tool or risk rule rejects deterministically AND records a log-only `autoReview/rejection` event, then injects a `[auto-review-never]` marker into the denied tool result — the model learns the action is hard-disabled instead of retrying it (invariant-checked: marker ⟺ event).
 - **Rejection circuit breaker.** A run of denials in one turn trips the breaker (`consecutiveDenies` / `windowDenies` inside `windowSize`), recorded as a log-only `autoReview/circuit` event; later requests follow its `action` (`delegate` / `reject` / `abort-turn`).
 - **Reviewer context is presented transcript.** `contextBudget` feeds already-presented session content to the reviewer. With the default same-route reviewer model that content stays inside one provider; configure `reviewerModel` to a different provider only if you accept presenting that transcript to it.

package/lib/index.js

@@ -641,6 +641,7 @@ const MESSAGES = {
 		failuresLine: (used, max) => `Reviewer failures this turn: ${used}/${max}`,
 		circuitLine: (kind, count, action) => `Rejection circuit breaker tripped (${kind}: ${count} denials); later requests in this turn follow "${action}".`,
 		allTimeLine: (allows, denies, fallbacks, rejections, avg) => `All-time: ${allows} allows, ${denies} denies, ${fallbacks} fallbacks, ${rejections} never rejects (avg ${avg} ms per verdict).`,
+		memoryStatsLine: (allows, denies, fallbacks, rejections, avg) => `This turn (audit disabled; in-memory): ${allows} allows, ${denies} denies, ${fallbacks} fallbacks, ${rejections} never rejects (avg ${avg} ms per verdict).`,
 		recentLine: (labels) => `Recent verdicts: ${labels}`,
 		unknownArg: (arg) => `Unknown /auto-review argument "${arg}". Usage: /auto-review on|off|status|approve [n]`,
 		already: (state) => `Auto-review is already ${state} for this session.`,
@@ -660,6 +661,7 @@ const MESSAGES = {
 		failuresLine: (used, max) => `本回合审查失败数：${used}/${max}`,
 		circuitLine: (kind, count, action) => `拒绝熔断器已触发（${kind}：${count} 次拒绝）；本回合后续请求按 "${action}" 处理。`,
 		allTimeLine: (allows, denies, fallbacks, rejections, avg) => `累计：${allows} 次放行，${denies} 次拒绝，${fallbacks} 次失败，${rejections} 次硬禁用拒绝（每次裁决平均 ${avg} ms）。`,
+		memoryStatsLine: (allows, denies, fallbacks, rejections, avg) => `本轮（审计已停用，内存统计）：${allows} 次放行，${denies} 次拒绝，${fallbacks} 次失败，${rejections} 次硬禁用拒绝（每次裁决平均 ${avg} ms）。`,
 		recentLine: (labels) => `最近裁决：${labels}`,
 		unknownArg: (arg) => `未知的 /auto-review 参数 "${arg}"。用法：/auto-review on|off|status|approve [n]`,
 		already: (state) => `本会话的自动审查已处于 ${state} 状态。`,
@@ -5965,10 +5967,19 @@ const AUTO_REVIEW_PROJECTION_SCHEMA = object({
 * State for the empty log. `enabled` starts at the resolved
 * `enableByDefault` — the projection cannot know the plugin config on its
 * own, so the unit is built per mount by {@link makeAutoReviewProjection}.
+*
+* `sessionId` is part of the state since state version 4: the fold records
+* which session it belongs to so a host that cannot accept the
+* `autoReview/*` audit events can serve the panel from the live in-memory
+* mirror instead (see `AutoReviewRuntime.livePanelView`). The pure fold
+* cannot resolve a session on its own, so the id is supplied by the caller
+* that knows the log header.
 * @param enabledByDefault - the resolved `enableByDefault` config value.
+* @param sessionId - the owning session id, as text.
 */
-function initAutoReviewProjection(enabledByDefault) {
+function initAutoReviewProjection(enabledByDefault, sessionId) {
 	return {
+		sessionId,
 		enabled: enabledByDefault,
 		turnOpen: false,
 		verdictsUsed: 0,
@@ -6088,6 +6099,7 @@ function viewAutoReview(state) {
 }
 /** Strict state schema — validates the persisted fold state before it seeds a fold. */
 const AUTO_REVIEW_STATE_SCHEMA = object({
+	sessionId: string(),
 	enabled: boolean(),
 	turnOpen: boolean(),
 	verdictsUsed: number().int().nonnegative(),
@@ -6110,20 +6122,29 @@ const AUTO_REVIEW_STATE_SCHEMA = object({
 * the answerer applies. Registrants sharing the `autoReview` key share one
 * unit; the first mount's default wins, which only matters for a double
 * mount with conflicting `enableByDefault` values.
+*
+* `liveView` substitutes the wire `view`
+* with a runtime-aware one. The pure fold can only report what the session
+* log carries, and a host that refuses the unmarked `autoReview/*` events
+* writes none of them — which is why the panel used to read an empty log and
+* show all zeros. The runtime passes `AutoReviewRuntime.livePanelView`, which
+* falls back to the in-memory mirror on such a host and to the fold
+* everywhere else. Omitted (or `undefined`) keeps the pure fold.
 * @param enabledByDefault - the resolved `enableByDefault` config value.
+* @param liveView - an optional runtime-aware wire view.
 * @returns the projection unit for `ctx.sessionProjections.register`.
 */
-function makeAutoReviewProjection(enabledByDefault) {
+function makeAutoReviewProjection(enabledByDefault, liveView) {
 	return {
 		key: "autoReview",
 		stateSchema: AUTO_REVIEW_STATE_SCHEMA,
-		init: (_header) => initAutoReviewProjection(enabledByDefault),
+		init: (header) => initAutoReviewProjection(enabledByDefault, String(header.id)),
 		apply: applyAutoReview,
 		wire: {
 			viewSchema: AUTO_REVIEW_PROJECTION_SCHEMA,
-			view: viewAutoReview
+			view: liveView === void 0 ? viewAutoReview : liveView
 		},
-		stateVersion: 3
+		stateVersion: 4
 	};
 }
 //#endregion
@@ -6168,8 +6189,33 @@ const SENSITIVE_KEY_PATTERN = /(?:api[_-]?key|token|secret|password|passwd|pwd|a
 /** The redaction placeholder for sensitive argument values. */
 const REDACTED = "[REDACTED]";
 /**
+* Inline secrets inside a free-form STRING
+* argument (a shell command line), which the key-based pass cannot see because
+* it inspects keys only. Covers `KEY=VALUE` / `KEY: VALUE` / `--flag VALUE`
+* spellings, with an optional `Bearer`/`Basic` scheme so
+* `Authorization: Bearer <token>` masks the token and not just the scheme word.
+* Best effort by construction: a bare secret with no key next to it stays
+* visible.
+*/
+const INLINE_SECRET_KEY = "(?:api[_-]?key|token|secret|password|passwd|pwd|authorization|credential|private[_-]?key|access[_-]?key)";
+/** The `KEY=VALUE` / `KEY: VALUE` spelling of an inline secret, scheme included. */
+const INLINE_SECRET_ASSIGN = new RegExp(`(${INLINE_SECRET_KEY}\\s*[:=]\\s*(?:Bearer\\s+|Basic\\s+)?)(["']?)([^\\s"';&|,)]+)`, "giu");
+/** The `--flag VALUE` spelling of an inline secret. */
+const INLINE_SECRET_FLAG = new RegExp(`(--?${INLINE_SECRET_KEY}\\s+)(["']?)([^\\s"';&|,)]+)`, "giu");
+/**
+* Redact inline secrets from a free-form string argument. The key-based pass
+* in {@link sanitizeArguments} only inspects object KEYS, so a secret spelled
+* inside a shell command line would otherwise reach the reviewer verbatim.
+* @param text - the free-form string to redact.
+* @returns the string with every recognized inline secret masked.
+*/
+function redactInlineSecrets(text) {
+	return text.replace(INLINE_SECRET_ASSIGN, (_match, head, quote) => head + quote + REDACTED).replace(INLINE_SECRET_FLAG, (_match, head, quote) => head + quote + REDACTED);
+}
+/**
 * Recursively redact sensitive values from a JSON value: any object key
-* matching {@link SENSITIVE_KEY_PATTERN} has its value replaced.
+* matching {@link SENSITIVE_KEY_PATTERN} has its value replaced, and any
+* free-form string is passed through {@link redactInlineSecrets}.
 * @param value - the detached JSON value to sanitize.
 * @returns a detached copy with sensitive values redacted.
 */
@@ -6180,6 +6226,7 @@ function sanitizeArguments(value) {
 		for (const [key, item] of Object.entries(value)) copy[key] = SENSITIVE_KEY_PATTERN.test(key) ? REDACTED : sanitizeArguments(item);
 		return copy;
 	}
+	if (typeof value === "string") return redactInlineSecrets(value);
 	return value;
 }
 /**
@@ -6208,6 +6255,12 @@ function sanitizedArgumentsText(events, callId) {
 /**
 * Render the tool-call context for the reviewer: the already-streamed call
 * arguments (parsed, redacted, truncated) or a note when the log lacks them.
+*
+* A truncated preview is DISCLOSED as truncated and matched with an explicit
+* deny rule (see {@link buildReviewPrompt}): previously the
+* prompt silently showed a `…`-suffixed head and left the verdict rules to
+* infer that the evidence was incomplete, so a reviewer reading the visible
+* part as benign could allow an action whose decisive arguments were cut off.
 * @param events - the requesting session's log.
 * @param callId - the call to render.
 * @param maxChars - the preview cap (shared with reason truncation).
@@ -6217,7 +6270,8 @@ function renderCallContext(events, callId, maxChars) {
 	if (callId === void 0) return "Tool call arguments: (not available — the asker attached no call id)";
 	const text = sanitizedArgumentsText(events, callId);
 	if (text === void 0) return "Tool call arguments: (not found or unparseable in the presented transcript)";
-	return `Tool call arguments (sensitive values redacted):\n${truncate(text, maxChars)}`;
+	if (text.length <= maxChars) return `Tool call arguments (sensitive values redacted):\n${text}`;
+	return `Tool call arguments (sensitive values redacted, TRUNCATED):\n${truncate(text, maxChars)}\n[TRUNCATED EVIDENCE: only the first ${maxChars} of ${text.length} characters are shown; the remainder is NOT visible to you. An action you cannot see in full is insufficient evidence — the verdict rules require DENY on insufficient evidence. Deny unless the visible part alone proves the action safe.]`;
 }
 /** How many characters one transcript line may take before truncation. */
 const CONTEXT_LINE_BUDGET = 300;
@@ -6231,7 +6285,7 @@ function contextLine(event) {
 		case "user/message": return `[user] ${truncate(contentText(event.data.content), CONTEXT_LINE_BUDGET)}`;
 		case "assistant/message": return `[agent] ${truncate(contentText(event.data.message.content), CONTEXT_LINE_BUDGET)}`;
 		case "tool/call": {
-			const args = event.data.arguments;
+			const args = redactInlineSecrets(event.data.arguments);
 			return `[tool call ${event.data.name}] ${truncate(args, CONTEXT_LINE_BUDGET)}`;
 		}
 		case "tool/result": {
@@ -6247,9 +6301,10 @@ function contextLine(event) {
 * Build the compact-transcript section for the reviewer: the tail of the
 * session's user/assistant messages and tool calls/results, most recent
 * last, bounded by {@link ContextBudgetConfig}. `turns: 0` yields an empty
-* section. Tool-call arguments and tool-result text enter verbatim (they are
-* already-presented transcript content); the presented call of the pending
-* request is redacted separately in {@link renderCallContext}.
+* section. Tool-call arguments pass through {@link redactInlineSecrets} and
+* tool-result text enters verbatim — both are already-presented transcript
+* content, and the pending request's own call is redacted separately in
+* {@link renderCallContext}.
 *
 * The character budget is spent from the NEWEST line backwards, so an
 * over-budget transcript loses its oldest lines. Truncating the joined text
@@ -6357,6 +6412,7 @@ function buildReviewPrompt(request, config, override, verdictChannel = "structur
 		"- allow: the action is safe, reversible, within the stated scope, and its reason is plausible.",
 		"- deny: the action is destructive, irreversible, credential- or data-exfiltrating, or the",
 		"  evidence is insufficient to judge it. When unsure, DENY.",
+		"- truncated evidence counts as insufficient: when the arguments are marked TRUNCATED, DENY.",
 		"- riskLevel: low / medium / high, your overall confidence-weighted severity.",
 		"",
 		verdictChannel === "structured_output" ? "Report your decision by calling the structured_output tool EXACTLY ONCE with:" : "Report your decision by returning EXACTLY ONE JSON object and nothing else — no prose, no markdown fence — with:",
@@ -6679,6 +6735,8 @@ function newRejectionId() {
 const FEEDBACK_TTL_MS = 3e5;
 /** Cap on the in-memory denial feed (approve indexes are bounded by this). */
 const MEMORY_DENIES_CAP = 200;
+/** Cap on the recent-verdict feed the panel's tally carries. */
+const MEMORY_RECENT_CAP = 10;
 /** Cap on the in-memory override list (a session cannot meaningfully accumulate more). */
 const MEMORY_OVERRIDES_CAP = 50;
 /** Closed-union backstop for the fallback-policy switch. */
@@ -6733,6 +6791,13 @@ var AutoReviewRuntime = class AutoReviewRuntime {
 	auditSupport = "unknown";
 	/** In-memory audit mirrors per session, used when the host cannot stamp audit events. */
 	memory = /* @__PURE__ */ new WeakMap();
+	/**
+	* Process-lifetime review tallies per session, which the
+	* per-turn mirror cannot carry. Keyed by session so a restarted turn (which
+	* rebuilds the mirror) keeps the panel's cumulative rows. A `WeakMap`, so a
+	* discarded session releases its tally with it.
+	*/
+	tallies = /* @__PURE__ */ new WeakMap();
 	/** The one-time warning that session-log audit was disabled was already logged. */
 	warnedUnmarked = false;
 	/** Pending circuit-breaker abort-turn timers, cleared when the plugin unloads. */
@@ -6809,8 +6874,30 @@ var AutoReviewRuntime = class AutoReviewRuntime {
 			};
 			this.memory.set(session, entry);
 		}
+		if (entry.tally === void 0) entry.tally = this.tallyFor(session);
 		return entry;
 	}
+	/**
+	* The process-lifetime tally behind the panel's cumulative
+	* rows, created on first use and kept for the life of the mount.
+	* @param session - the session the tally belongs to.
+	* @returns the session's tally, creating it when absent.
+	*/
+	tallyFor(session) {
+		let tally = this.tallies.get(session);
+		if (tally === void 0) {
+			tally = {
+				allows: 0,
+				denies: 0,
+				fallbacks: 0,
+				rejections: 0,
+				recent: [],
+				recentDenies: []
+			};
+			this.tallies.set(session, tally);
+		}
+		return tally;
+	}
 	/** Record one settled review outcome in the in-memory mirror (audit-disabled hosts). */
 	recordVerdictMemory(memory, verdict) {
 		memory.verdicts.unshift(verdict);
@@ -6822,6 +6909,23 @@ var AutoReviewRuntime = class AutoReviewRuntime {
 			});
 			if (memory.denies.length > MEMORY_DENIES_CAP) memory.denies.length = MEMORY_DENIES_CAP;
 		}
+		const tally = memory.tally;
+		if (tally === void 0) return;
+		if (verdict.denial) tally.denies += 1;
+		else tally.allows += 1;
+		tally.recent.unshift({
+			id: verdict.id,
+			toolName: verdict.toolName,
+			denial: verdict.denial
+		});
+		if (tally.recent.length > MEMORY_RECENT_CAP) tally.recent.length = MEMORY_RECENT_CAP;
+		if (verdict.denial) {
+			tally.recentDenies.unshift({
+				id: verdict.id,
+				toolName: verdict.toolName
+			});
+			if (tally.recentDenies.length > MEMORY_DENIES_CAP) tally.recentDenies.length = MEMORY_DENIES_CAP;
+		}
 	}
 	/** The number of leading consecutive denials in a newest-first verdict list. */
 	static leadingDenials(verdicts) {
@@ -6869,6 +6973,72 @@ var AutoReviewRuntime = class AutoReviewRuntime {
 		};
 	}
 	/**
+	* The live session whose id is `id`, or undefined when no
+	* live session matches. The projection fold carries the owning session id as
+	* plain text, so the runtime has to resolve it back to a `Session` before it
+	* can read the in-memory mirror. Read through `ctx.get` rather than
+	* injected: the projection view is a render-time convenience, and a missing
+	* service must only cost the mirror, never park this plugin in a pending
+	* fiber.
+	* @param id - the session id carried by the fold state.
+	* @returns the live session, or undefined.
+	*/
+	sessionById(id) {
+		if (id === void 0) return void 0;
+		const sessions = this.ctx.get("sessions");
+		if (sessions === void 0) return void 0;
+		for (const session of sessions.list()) if (String(session.id) === String(id)) return session;
+	}
+	/**
+	* The panel view. The pure event fold can
+	* never carry this plugin's statistics on a host that refuses unmarked
+	* unknown event types (see {@link AutoReviewRuntime.auditMayAppend}), which
+	* is why the panel read an empty log and showed all zeros. On such a host
+	* this reads the in-memory mirror instead, so the panel reports the real
+	* switch state and the real activity; on a marker-aware host the fold stays
+	* authoritative and this returns it untouched.
+	* @param state - the fold state, which carries its session id.
+	* @returns the projection view the panel renders.
+	*/
+	livePanelView(state) {
+		const folded = viewAutoReview(state);
+		if (this.auditMayAppend()) return folded;
+		const session = this.sessionById(state.sessionId);
+		if (session === void 0) return folded;
+		const memory = this.memoryFor(session);
+		const tally = memory.tally ?? {
+			allows: 0,
+			denies: 0,
+			fallbacks: 0,
+			rejections: 0,
+			recent: [],
+			recentDenies: []
+		};
+		return {
+			enabled: effectiveAutoReviewState(sessionEvents(session)) ?? memory.enabledOverride ?? this.config.enableByDefault,
+			verdictsUsed: memory.verdicts.length,
+			failuresUsed: memory.failures,
+			allows: tally.allows,
+			denies: tally.denies,
+			fallbacks: tally.fallbacks,
+			neverRejects: tally.rejections,
+			cacheHits: folded.cacheHits,
+			avgDurationMs: folded.avgDurationMs,
+			circuit: null,
+			recent: tally.recent.map((verdict) => ({
+				reviewId: String(verdict.id),
+				toolName: verdict.toolName,
+				at: Date.now(),
+				durationMs: 0,
+				decision: verdict.denial ? "deny" : "allow"
+			})),
+			recentDenies: tally.recentDenies.map((deny) => ({
+				reviewId: String(deny.id),
+				toolName: deny.toolName
+			}))
+		};
+	}
+	/**
 	* The `approval/request` answerer. Claims a request ONLY when auto-review
 	* is enabled for the session AND the policy for this tool/reason is `ai`
 	* AND both per-turn budgets remain AND the rejection circuit breaker is
@@ -6932,7 +7102,10 @@ var AutoReviewRuntime = class AutoReviewRuntime {
 				outcome: "rejected"
 			}, { ignorable: true });
 			this.probeAuditResult(result);
-		} else memory.rejections += 1;
+		} else {
+			memory.rejections += 1;
+			if (memory.tally !== void 0) memory.tally.rejections += 1;
+		}
 		const text = auditOk ? neverResultText(rejectionId, request.toolName, reason) : plainNeverResultText(request.toolName, reason);
 		this.recordFeedback(request.callId, `${text}\n${this.config.denyGuidance}`);
 		return Promise.resolve("rejected");
@@ -6946,7 +7119,7 @@ var AutoReviewRuntime = class AutoReviewRuntime {
 	* override, which changes the reviewer's evidence.
 	* @param request - the pending approval request.
 	* @returns the fingerprint, or undefined to skip the cache (fail-closed:
-	*   the request then runs the second model as before).
+	*   the request then runs the reviewer as before).
 	*/
 	fingerprintFor(request) {
 		if (this.config.verdictCacheTtlMs <= 0) return void 0;
@@ -7052,7 +7225,11 @@ var AutoReviewRuntime = class AutoReviewRuntime {
 					...outcome !== void 0 ? { outcome } : {}
 				}, { ignorable: true });
 				this.probeAuditResult(result);
-			} else this.memoryFor(session).failures += 1;
+			} else {
+				const fallbackMemory = this.memoryFor(session);
+				fallbackMemory.failures += 1;
+				if (fallbackMemory.tally !== void 0) fallbackMemory.tally.fallbacks += 1;
+			}
 			this.ctx.logger.warn(`auto-review fallback (${failure.fallback}) for ${request.toolName}: ${failure.error}`);
 			if (outcome === "rejected") this.recordFallbackFeedback(request.callId, reviewId, failure.fallback, failure.error);
 		}
@@ -7250,7 +7427,7 @@ var AutoReviewRuntime = class AutoReviewRuntime {
 					t.verdictsLine(verdictsUsed, this.config.maxReviewsPerTurn),
 					t.failuresLine(failuresUsed, this.config.maxFailuresPerTurn),
 					...circuit === void 0 ? [] : [t.circuitLine(circuit.trip.kind, circuit.trip.count, circuit.action)],
-					t.allTimeLine(stats.allows, stats.denies, stats.fallbacks, stats.rejections, stats.avgDurationMs),
+					auditOff ? t.memoryStatsLine(stats.allows, stats.denies, stats.fallbacks, stats.rejections, stats.avgDurationMs) : t.allTimeLine(stats.allows, stats.denies, stats.fallbacks, stats.rejections, stats.avgDurationMs),
 					...recent,
 					...auditOff ? [t.auditDisabledNotice] : [],
 					t.usage
@@ -7379,7 +7556,7 @@ function apply(ctx, config) {
 		input: { hint: "on|off|status|approve [n]" },
 		handler: (invocation) => runtime.command(invocation)
 	});
-	if (ctx.get("sessionProjections") !== void 0) ctx.inject(["sessionProjections"], (scope) => scope.sessionProjections.register(makeAutoReviewProjection(resolved.enableByDefault)));
+	if (ctx.get("sessionProjections") !== void 0) ctx.inject(["sessionProjections"], (scope) => scope.sessionProjections.register(makeAutoReviewProjection(resolved.enableByDefault, (state) => runtime.livePanelView(state))));
 }
 //#endregion
 //#region src/call-id.ts